Legal & Compliance
How Ulwazi Nexus collects, uses, protects, and discloses your personal information — in full compliance with the Protection of Personal Information Act, No. 4 of 2013.
Ulwazi Nexus (Pty) Ltd ("Ulwazi Nexus", "we", "us" or "our") is a private company incorporated and registered in South Africa (Registration No. 2026/429458/07), with its principal place of business in Johannesburg, Gauteng. We are a 100% Black-owned, Level 1 B-BBEE technology company.
We are the Responsible Party in terms of POPIA for all personal information processed through our platforms, products, and services.
This Privacy Notice applies to all personal information processed by Ulwazi Nexus in connection with:
This Notice applies regardless of the platform or device through which you access our services, including our mobile applications available on Google Play and Microsoft AppSource.
Note: If you are accessing our services through a third-party application store (Google Play or Microsoft AppSource), their respective privacy policies also apply to information collected by those platforms. We encourage you to review them.
The categories of personal information we may collect depend on which of our products or services you use.
We collect personal information through the following means:
We process personal information only for specific, explicitly defined, and lawful purposes. The table below sets out our primary processing purposes and the lawful basis under POPIA for each:
| Purpose | Lawful Basis (POPIA) |
|---|---|
| Creating and managing your account | Contractual necessity; consent |
| Delivering our products and services | Contractual necessity |
| Processing payments and maintaining billing records | Contractual necessity; legal obligation |
| Real-time GPS location tracking (KidGuard) | Consent of account holder (parent/guardian) |
| Geofence and safe-zone alerts (KidGuard) | Consent; legitimate interest (child safety) |
| Product authentication and anti-counterfeit scanning (VerifyQR) | Contractual necessity; legitimate interest |
| e-Waste collection scheduling and tracking (EcoLink) | Contractual necessity; legal obligation (WEEE compliance) |
| Panic-alert response and incident management (Nexus Pulse) | Consent; legitimate interest (safety) |
| Customer support and query resolution | Contractual necessity; legitimate interest |
| System security, fraud prevention, and abuse detection | Legitimate interest; legal obligation |
| Platform analytics and service improvement | Legitimate interest; consent (where required) |
| Marketing communications (opt-in only) | Consent |
| Compliance with legal or regulatory obligations | Legal obligation |
We do not use your personal information for automated decision-making that produces legal or similarly significant effects without human oversight.
KidGuard is a child-safety GPS tracking device. The parent or guardian who registers the account is the account holder and data subject for consent purposes. The child's location data is processed exclusively for the purposes of child safety, geofencing, and SOS response. We do not use a child's location data for any commercial, advertising, or analytics purpose. Location data is encrypted in transit and at rest, and is accessible only to the registered parent/guardian account holder and authorised Ulwazi Nexus technical staff for support purposes.
VerifyQR processes product authentication data on behalf of our business clients. End-consumer scan data (timestamp, country-level location, user-agent) is collected to detect counterfeiting patterns. We process only the minimum information necessary to confirm authenticity and generate brand-protection analytics. No personally identifiable consumer information is required to scan a VerifyQR code.
EcoLink processes organisational and contact information to facilitate e-waste collection, device lifecycle tracking, and regulatory compliance reporting. Personal information of field agents and site contacts may be processed to coordinate collections and sign off on compliance certificates. This information is shared only with the relevant client organisation and, where required, with regulatory bodies.
Nexus Command Center is our multi-tenant management console. User accounts, role assignments, audit logs, and activity records are processed to enable secure, accountable platform management. Audit logs are retained for a minimum of 12 months to support security and compliance reviews.
Nexus Pulse processes panic-alert triggers, responder location data, and incident records. This information is time-sensitive and processed in real time for emergency response purposes. Incident records are retained in accordance with our retention schedule (Section 10) and may be shared with estate management, security companies, or law enforcement where legally required or where you have consented.
Ulwazi Nexus is acutely aware of its obligations regarding the personal information of children (persons under 18 years of age) under Section 34 and 35 of POPIA, which impose heightened protections.
If you believe a child has provided us with personal information without your consent, please contact us immediately at privacy@ulwazinexus.io and we will address it without delay.
We do not sell, rent, or trade your personal information to third parties. We may share it only in the following circumstances:
We engage third-party service providers who process personal information on our behalf as Operators under POPIA. These include:
All Operators are bound by written agreements that require them to process personal information only on our instructions and to maintain appropriate security safeguards.
Where you are an employee, field agent, or end user registered on one of our platforms by an enterprise or government client, we may share relevant account and activity data with that client organisation as the contracting party.
We may disclose personal information where required to do so by law, court order, or lawful request by a public authority — including to comply with regulatory obligations or to protect the rights, property, or safety of Ulwazi Nexus, our clients, or the public.
In the event of a merger, acquisition, restructuring, or sale of all or substantially all of our assets, personal information may be transferred to the successor entity, subject to equivalent privacy protections. We will notify affected data subjects where required by law.
We may share your personal information with third parties where you have given us explicit consent to do so.
Section 72 of POPIA restricts the transfer of personal information to recipients outside South Africa unless certain conditions are met.
Some of our service providers are based in countries other than South Africa (for example, cloud infrastructure providers with servers in Europe or the United States). Where we transfer personal information outside South Africa, we ensure that:
We maintain a record of all cross-border data flows and can provide details on request to our Information Officer.
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention guidelines are:
| Category | Retention Period |
|---|---|
| Active account data | Duration of the account, plus 12 months after closure |
| KidGuard location history | 90 days rolling (configurable by account holder) |
| VerifyQR scan records | 24 months from scan date |
| EcoLink disposal certificates and compliance records | 5 years (statutory requirement) |
| Nexus Pulse incident records | 3 years from incident date |
| Command Center audit logs | 12 months minimum, up to 3 years |
| Financial / billing records | 5 years (South African tax and accounting law) |
| Support and communication records | 3 years from last interaction |
| Marketing consent records | Until consent is withdrawn, plus 3 years |
Upon expiry of the applicable retention period, personal information is securely deleted or anonymised.
We implement appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction, in accordance with Section 19 of POPIA. These measures include:
In the event of a data security compromise that poses a risk to your personal information, we will notify the Information Regulator and affected data subjects within the timeframes required by POPIA (Section 22). Notification will be provided via email and/or prominent notice on our platform.
POPIA grants you specific rights in relation to your personal information. These rights are set out in Sections 23–25 of POPIA and include:
You have the right to request a record of the personal information we hold about you (POPIA s.23).
You may request that we correct or update inaccurate or incomplete personal information (POPIA s.24).
You may request that we delete personal information we no longer have a lawful basis to retain (POPIA s.24).
You may object to the processing of your personal information on grounds of legitimate interest or for direct marketing purposes (POPIA s.11(3)).
Where processing is based on your consent, you may withdraw it at any time without affecting prior lawful processing.
You have the right to lodge a complaint with the Information Regulator of South Africa if you believe your rights have been infringed.
To exercise any of the above rights, please submit a written request to our Information Officer at privacy@ulwazinexus.io. We will respond within the timeframes prescribed by POPIA. We may need to verify your identity before processing your request.
Access requests may be submitted using the Information Regulator's prescribed Form 2 (PAIA Manual) or in any clear written format.
Our website and web-based platforms use cookies and similar tracking technologies to improve your experience, understand how our services are used, and ensure platform security.
| Cookie Type | Purpose | Basis |
|---|---|---|
| Strictly Necessary | Session management, authentication, security tokens | Necessary for service delivery — no opt-out |
| Functional | Remembering your preferences and settings | Legitimate interest / consent |
| Analytics | Understanding platform usage and improving features | Consent |
| Marketing | Serving relevant communications (opt-in only) | Consent |
You can manage your cookie preferences through our cookie consent banner or through your browser settings. Disabling cookies may affect the functionality of our platforms. Our mobile applications may use equivalent device identifiers for analytics purposes, subject to your device's privacy settings.
Our website and communications may contain links to third-party websites, and our applications are distributed through third-party app stores. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy notices of any third-party platforms you visit or use:
This Notice does not govern information collected by those third parties.
We may update this Privacy Notice from time to time to reflect changes in our practices, services, or legal obligations. When we make material changes, we will:
We encourage you to review this Notice periodically. Your continued use of our services after the effective date of an updated Notice constitutes your acceptance of the changes, to the extent permitted by law.
If you have any questions, concerns, or requests relating to this Privacy Notice or the processing of your personal information, please contact our Information Officer:
We aim to respond to all privacy-related requests within 5 business days, and to resolve them within the timeframes prescribed by POPIA. If you are not satisfied with our response, you may escalate your complaint to the Information Regulator of South Africa (details in Section 12).
↑ Back to topGet in Touch
Our Information Officer is ready to assist. Reach out and we'll respond personally and promptly.
Contact us on WhatsApp